I have written this in a cron to run every 10 mins and restart topbeat if it is not sending events to logstash for 10 mins. This so far is working:
dd=`date -d'now-10 minutes' +%Y/%m/%d\ %H:%M:%S`
tail -n 1000 topbeat.log | awk -vDate="$dd" '$1" "$2 > Date {print $0}' | grep 'sent to logstash' | grep -v 'int=0'
if [ $? -eq 0 ]
then
echo "Topbeat sending events successfully"
else
echo "Kill existing topbeat"
ps aux | grep topbeat.yml | grep -v "grep" | awk '{print $2}' | xargs kill
echo "Restart topbeat"
nohup ./run.sh > topbeat.log &
fi